Hardcoded absolute path breaks portability for all contributors

The path "/home/user/everything-claude-code/.claude/.cpd-wrappers/..." is the author's local machine path. This settings.json is committed as a project-level Claude Code settings file, meaning it applies to every contributor who clones the repo. Anyone who has the project checked out at a different location (which is virtually everyone) will have a broken plugin configuration since the directory path won't resolve.

The cpd-meta.json file has the same issue at "cwd": "/home/user/everything-claude-code" (line 6).

These files appear to have been auto-generated by the ClaudePluginHub CLI and contain machine-specific state that shouldn't be committed to a shared repository. Consider either:

1. Excluding these generated wrapper files via .gitignore
2. Using a relative path if the tool supports it
3. Providing a setup script/instruction so each developer runs the CLI themselves

Machine-specific cwd path hardcoded

"cwd": "/home/user/everything-claude-code" is the author's local working directory baked into a committed config file. If the plugin runtime uses this field to resolve plugin resources, it will silently fail for all other contributors whose checkout is in a different directory.

This field is likely generated by the ClaudePluginHub CLI and is not intended to be shared in version control.

Project-level settings.json silently enables a third-party plugin for all contributors

.claude/settings.json is the project-level Claude Code settings file. By committing it with "enabledPlugins": { "claude-hud@cpd-jarrodwatts-claude-hud-project": true }, this PR automatically enables a third-party plugin sourced from jarrodwatts/claude-hud on GitHub for every developer who opens this repository — without their explicit consent.

Plugin code fetched from an external GitHub repo runs within Claude Code's execution context and can issue arbitrary shell commands, modify files, or make network requests. Committing a shared settings file that opts-in all contributors to a third-party plugin is a significant security concern that should at minimum be prominently documented and opt-in per-developer (e.g., in user-level settings, not project-level settings).

Replace user-specific marketplace path with portable source

The configured marketplace source uses a hard-coded absolute path under one developer’s home directory, so plugin resolution fails whenever the repo is checked out elsewhere (CI, other contributors, containers, or different home paths). In those environments, claude-hud@cpd-jarrodwatts-claude-hud-project cannot be loaded because the directory source does not exist. Use a portable reference (for example a repo source) or a path derived from the current project root.

Useful? React with 👍 / 👎.

The marketplace path is hard-coded to a local absolute directory (/home/user/...). This makes the config non-portable for other contributors and also leaks a local filesystem path. Prefer a repo-relative path (e.g., relative to the project root) or a supported variable (if Claude supports it) so the plugin works on any machine.

This enables a third-party plugin by default for anyone using project-level Claude settings. If that’s not an intentional policy for this repo, consider leaving it disabled by default (or moving this guidance to docs) so contributors opt in explicitly.

The cwd field is set to an absolute local path (/home/user/...). This will not be valid on other machines and may leak local environment details. Use a relative path (e.g., ".") or remove cwd if it’s optional so the wrapper is portable.

PR description says the marketplace definition was created at .claude/.cpd-wrappers/jarrodwatts-claude-hud-project/marketplace.json, but the actual file path added is under .claude-plugin/marketplace.json. Please update the PR description (or file location) so it accurately reflects what was added.

P1: Marketplace configuration introduces a mutable external GitHub plugin source, creating supply-chain and reproducibility risk.

Check if this issue is valid — if so, understand the root cause and fix it. At .claude/.cpd-wrappers/jarrodwatts-claude-hud-project/.claude-plugin/marketplace.json, line 11:

<comment>Marketplace configuration introduces a mutable external GitHub plugin source, creating supply-chain and reproducibility risk.</comment>

<file context>
@@ -0,0 +1,16 @@
+      "name": "claude-hud",
+      "source": {
+        "source": "github",
+        "repo": "jarrodwatts/claude-hud"
+      },
+      "strict": false
</file context>

P1: Project config hardcodes a developer-specific absolute cwd, making plugin setup non-portable across machines and CI.

Check if this issue is valid — if so, understand the root cause and fix it. At .claude/.cpd-wrappers/jarrodwatts-claude-hud-project/cpd-meta.json, line 6:

<comment>Project config hardcodes a developer-specific absolute `cwd`, making plugin setup non-portable across machines and CI.</comment>

<file context>
@@ -0,0 +1,7 @@
+  "pluginName": "claude-hud",
+  "marketplaceName": "cpd-jarrodwatts-claude-hud-project",
+  "scope": "project",
+  "cwd": "/home/user/everything-claude-code"
+}
</file context>

P2: Project settings auto-enable a third-party plugin from a directory/GitHub-backed wrapper without visible integrity pinning or explicit opt-in, creating a supply-chain trust risk.

Check if this issue is valid — if so, understand the root cause and fix it. At .claude/settings.json, line 11:

<comment>Project settings auto-enable a third-party plugin from a directory/GitHub-backed wrapper without visible integrity pinning or explicit opt-in, creating a supply-chain trust risk.</comment>

<file context>
@@ -0,0 +1,13 @@
+    }
+  },
+  "enabledPlugins": {
+    "claude-hud@cpd-jarrodwatts-claude-hud-project": true
+  }
+}
</file context>

P2: Committed plugin marketplace config uses a machine-specific absolute path, making plugin loading non-portable across developers and CI.

Check if this issue is valid — if so, understand the root cause and fix it. At .claude/settings.json, line 6:

<comment>Committed plugin marketplace config uses a machine-specific absolute path, making plugin loading non-portable across developers and CI.</comment>

<file context>
@@ -0,0 +1,13 @@
+    "cpd-jarrodwatts-claude-hud-project": {
+      "source": {
+        "source": "directory",
+        "path": "/home/user/everything-claude-code/.claude/.cpd-wrappers/jarrodwatts-claude-hud-project"
+      }
+    }
</file context>

⚠️ Potential issue | 🟠 Major

Pin the GitHub plugin source to the v0.0.11 tag.

Add the ref field to the source object to pin to the version specified in the PR. Without it, installs will track the default branch instead of v0.0.11:

      "name": "claude-hud",
      "source": {
        "source": "github",
        "repo": "jarrodwatts/claude-hud",
        "ref": "v0.0.11"
      },

Alternatively, use sha with a full commit hash for exact immutable pinning.

Verify each finding against the current code and only fix it if needed.

In
@.claude/.cpd-wrappers/jarrodwatts-claude-hud-project/.claude-plugin/marketplace.json
around lines 8 - 12, The marketplace entry for the "claude-hud" plugin currently
omits a version pin; update the source object for "claude-hud" by adding a ref
(e.g., "v0.0.11") or a sha commit hash to the source object so installs are
pinned to the exact release instead of tracking the default branch; modify the
JSON for the "source" object that contains "source":"github" and
"repo":"jarrodwatts/claude-hud" to include the new "ref" (or "sha") field.

⚠️ Potential issue | 🟠 Major

Use a relative project-root path for marketplace directory.

At Line 6, the absolute path /home/user/everything-claude-code/.claude/.cpd-wrappers/jarrodwatts-claude-hud-project is hardcoded and will fail portably across developers and CI environments. Switch to a relative path prefixed with ./ (e.g., ./.claude/.cpd-wrappers/jarrodwatts-claude-hud-project), which is resolved from the project root. Absolute paths may silently fail in Claude settings.

Verify each finding against the current code and only fix it if needed.

In @.claude/settings.json at line 6, Change the hardcoded absolute path value
for the JSON "path" key in settings.json to a project-root relative path (prefix
with ./) so it works across dev/CI environments; specifically replace the
absolute string value that points to the marketplace wrapper (the current
jarrodwatts-claude-hud-project path) with a relative equivalent like
./.claude/.cpd-wrappers/jarrodwatts-claude-hud-project and commit the updated
settings.json.